{"id":"CVE-2026-126308","kind":"vulnerability","aliases":["CVE-2026-126308"],"related":[],"title":"Coder dashboard leaks full API key to attacker-chosen app URLs","description":"The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination.","summary":"The Coder web dashboard substitutes a full-access API key into external app URLs without checking whether the app is a sub-agent. Code running in a workspace can register a disguised app, so when the owner clicks it their API key is sent to an attacker-chosen destination.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coder","infrastructure","self-hosted","workspaces"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"- Check the Coder server version with `coder version` and compare it to the fixed ranges below.\n- Confirm whether untrusted code can run in your workspaces, since that is what allows an app to be registered.","fix":"- Coder `2.29.23` for the 2.24.x line\n- Coder `2.34.14` for the 2.30.x line\n- Coder `2.36.9` for the 2.35.x line\n- Coder `2.37.6` for the 2.37.x line\n- Coder `2.38.2` for the 2.38.x line","status":"open","published_at":"2026-11-13T10:17:36+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","triaged_at":"2026-11-13T10:50:23+00:00","updated_at":"2026-11-13T10:50:23+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T10:50:23Z","model":"claude-haiku-5-5","output":{"fix":"- Coder `2.29.23` for the 2.24.x line\n- Coder `2.34.14` for the 2.30.x line\n- Coder `2.36.9` for the 2.35.x line\n- Coder `2.37.6` for the 2.37.x line\n- Coder `2.38.2` for the 2.38.x line","reach":"internet","title":"Coder dashboard leaks full API key to attacker-chosen app URLs","impact":"high","summary":"The Coder web dashboard substitutes a full-access API key into external app URLs without checking whether the app is a sub-agent. Code running in a workspace can register a disguised app, so when the owner clicks it their API key is sent to an attacker-chosen destination.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["coder","self-hosted","workspaces"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"full API key sent to attacker-chosen destination, enabling account takeover","analyst_note":"","how_to_check":"- Check the Coder server version with `coder version` and compare it to the fixed ranges below.\n- Confirm whether untrusted code can run in your workspaces, since that is what allows an app to be registered.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-outside-affected-ranges"],"who_is_affected":"Any team running a self-hosted Coder server whose version falls in an affected range, especially where users run code they do not fully trust inside workspaces. The exposure is through the web dashboard's handling of external app URLs, so deployments that do not use that dashboard with sub-agent apps are less exposed. unknown whether managed Coder hosting is affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000784,"input_tokens":4714,"output_tokens":626,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126308':15A,18A '-2026':14A,17A '2.24.0':82C '2.29.23':84C '2.30.0':85C '2.34.14':87C '2.35.0':88C '2.36.9':90C '2.37.0':91C '2.37.6':93C '2.38.0':95C '2.38.2':97C 'access':33B,111C 'agent':49B,124C,136C 'api':5A,34B,67B,112C,150C 'app':11A,38B,44B,59B,105C,118C,137C 'attack':9A,74B,155C 'attacker-chosen':8A,73B,154C 'belong':119C 'check':41B,115C 'chosen':10A,75B,156C 'click':64B,147C 'code':50B,125C 'coder':1A,19B,26B,81C 'custom':140C 'cve':13A,16A 'dashboard':2A,28B,79C 'destin':76B,157C 'disguis':58B,133C 'extern':37B,104C 'full':4A,32B,110C 'full-access':31B,109C 'host':23B 'infrastructur':20B 'key':6A,35B,68B,113C,151C 'leak':3A 'owner':63B,145C 'placehold':102C 'protocol':141C 'regist':56B,131C 'replac':98C 'run':51B,126C 'self':22B 'self-host':21B 'send':148C 'sent':70B 'session':100C 'sub':48B,123C,135C 'sub-ag':47B,122C,134C 'substitut':29B 'token':101C 'url':12A,39B,106C,142C 'web':27B,78C 'whether':42B,116C 'without':40B,114C 'workspac':24B,54B,129C","nicknames":[],"mitigations":[],"who_affected":"Any team running a self-hosted Coder server whose version falls in an affected range, especially where users run code they do not fully trust inside workspaces. The exposure is through the web dashboard's handling of external app URLs, so deployments that do not use that dashboard with sub-agent apps are less exposed. unknown whether managed Coder hosting is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["coder","high","infrastructure","selfhosted","workspaces"],"campaign_type":null,"search_a":"'-126308':15A,18A '-2026':14A,17A 'api':5A 'app':11A 'attack':9A 'attacker-chosen':8A 'chosen':10A 'coder':1A 'cve':13A,16A 'dashboard':2A 'full':4A 'key':6A 'leak':3A 'url':12A","search_b":"'access':33B 'agent':49B 'api':34B,67B 'app':38B,44B,59B 'attack':74B 'attacker-chosen':73B 'check':41B 'chosen':75B 'click':64B 'code':50B 'coder':19B,26B 'dashboard':28B 'destin':76B 'disguis':58B 'extern':37B 'full':32B 'full-access':31B 'host':23B 'infrastructur':20B 'key':35B,68B 'owner':63B 'regist':56B 'run':51B 'self':22B 'self-host':21B 'sent':70B 'sub':48B 'sub-ag':47B 'substitut':29B 'url':39B 'web':27B 'whether':42B 'without':40B 'workspac':24B,54B","search_c":"'2.24.0':82C '2.29.23':84C '2.30.0':85C '2.34.14':87C '2.35.0':88C '2.36.9':90C '2.37.0':91C '2.37.6':93C '2.38.0':95C '2.38.2':97C 'access':111C 'agent':124C,136C 'api':112C,150C 'app':105C,118C,137C 'attack':155C 'attacker-chosen':154C 'belong':119C 'check':115C 'chosen':156C 'click':147C 'code':125C 'coder':81C 'custom':140C 'dashboard':79C 'destin':157C 'disguis':133C 'extern':104C 'full':110C 'full-access':109C 'key':113C,151C 'owner':145C 'placehold':102C 'protocol':141C 'regist':131C 'replac':98C 'run':126C 'send':148C 'session':100C 'sub':123C,135C 'sub-ag':122C,134C 'token':101C 'url':106C,142C 'web':78C 'whether':116C 'without':114C 'workspac':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:31:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126308","severity":null,"published_at":"2026-11-13T10:17:36+00:00","modified_at":"2026-11-13T10:17:36+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","fetched_at":"2026-11-13T10:47:15+00:00","note":null}],"documents":[{"id":144947,"url":"https://github.com/coder/coder/security/advisories/GHSA-2x8w-q434-f76p","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:31:06+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144948,"url":"https://www.vulncheck.com/advisories/coder-2.38.0-before-2.38.2-session-token-leak-via-sub-agent-external-apps","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}